Prepare the server locally
Run this once before adding it to Claude Code.
git clone https://github.com/NeuraLegion/mcp
cd mcpThen follow the repository README for any remaining dependency or build steps.
Register it in Claude Code
claude mcp add --transport http -H "Authorization: Api-Key YOUR_API_KEY" bright-security https://app.brightsec.com/mcpReplace any placeholder paths in the command with the real path on your machine.
AuthorizationMake your agent remember this setup
bright-security's config, env vars, and the gotchas you hit — recalled in every future Claude Code, Cursor, and Codex session.
npx conare@latestFree · one command · indexes the sessions already on disk. Set up in the browser instead →
What it does
- Automated discovery of API endpoints via crawling or definition files
- End-to-end management of security scans through natural language
- Integration with existing CI/CD workflows via AI assistants
- Support for project-level and organization-level security analysis
- Remote, cloud-hosted architecture requiring no local installation
Tools 6
listProjectsList all projects accessible to your API key.runDiscoveryDiscover API endpoints using crawling or API definitions.getDiscoveryStatusGet the current status of a discovery run.listDiscoveriesList discovery history for a project.uploadApiDefinitionUpload an API definition file (OpenAPI/Swagger) by URL or content.listEntrypointsList discovered API endpoints/URLs for a project.Environment Variables
AuthorizationrequiredAPI Key for authenticating with the Bright Security platformTry it
Original README from NeuraLegion/mcp
Bright MCP Integration
Bright's Model Context Protocol (MCP) integration brings AI-powered application security testing directly into your development workflow. Your AI coding assistant can discover API endpoints, run security scans, and review vulnerabilities — all through natural language conversation.
Bright MCP is a remote, cloud-hosted MCP server. There is nothing to install locally — you simply point your MCP-compatible client at Bright's endpoint and authenticate with an API key.
Quick Start
1. Get a Bright API Key
Create a dedicated API key in your Bright account. This can be a personal, project, or organization-level key with the relevant scopes. See Personal API Key Scopes for details.
2. Configure Your Client
Add Bright as a remote MCP server in your IDE or tool of choice. The server URL is:
https://app.brightsec.com/mcp
Note: If your organization uses a dedicated Bright cluster, replace
app.brightsec.comwith your cluster's hostname.
See Client Configuration below for IDE-specific instructions.
3. Start Using It
Ask your AI assistant something like:
Scan https://my-app.example.com for security vulnerabilities
Your assistant will use the Bright MCP tools to list projects, discover entrypoints, run scans, and report findings.
Client Configuration
VS Code (GitHub Copilot)
Add the following to your MCP configuration (via Command Palette → "MCP: Add Server" → Global, or manually edit your mcp.json):
{
"servers": {
"brightsec.com": {
"type": "sse",
"url": "https://app.brightsec.com/mcp",
"headers": {
"Authorization": "Api-Key ${input:apiKey}"
}
}
},
"inputs": [
{
"type": "promptString",
"id": "apiKey",
"description": "Enter your Bright API Key",
"password": true
}
]
}
Then go to the Extensions tab, right-click the brightsec.com MCP server, and choose Start Server. You'll be prompted to enter your API key.
Full guide: Configure Bright MCP in VS Code
Augment Code
- Open the Augment Code extension settings → Tools → MCP.
- Click + Add remote MCP.
- Fill in:
- Connection Type: HTTP
- Authentication Type: Header
- Name: BrightSec
- URL:
https://app.brightsec.com/mcp - Header Name:
Authorization - Header Value:
Api-Key YOUR_API_KEY
- Click Save.
Full guide: Configure Bright MCP in Augment Code
Cursor
Add to your Cursor MCP settings (.cursor/mcp.json):
{
"mcpServers": {
"brightsec": {
"url": "https://app.brightsec.com/mcp",
"headers": {
"Authorization": "Api-Key YOUR_API_KEY"
}
}
}
}
Windsurf
Add to your Windsurf MCP configuration (~/.codeium/windsurf/mcp_config.json):
{
"mcpServers": {
"brightsec": {
"serverUrl": "https://app.brightsec.com/mcp",
"headers": {
"Authorization": "Api-Key YOUR_API_KEY"
}
}
}
}
Generic MCP Client
Any MCP-compatible client that supports remote HTTP/SSE servers can connect to Bright. Configure it with:
| Setting | Value |
|---|---|
| Transport | SSE (Server-Sent Events) or HTTP |
| URL | https://app.brightsec.com/mcp |
| Auth Header | Authorization: Api-Key YOUR_KEY |
Available Tools
Bright MCP exposes the following tools to your AI assistant:
Project Management
| Tool | Description |
|---|---|
| listProjects | List all projects accessible to your API key. Use this to find project IDs needed for other operations. |
Endpoint Discovery
| Tool | Description |
|---|---|
| runDiscovery | Discover API endpoints using crawling (crawlerUrls) or API definitions (fileId from uploadApiDefinition). Before running, check if the project already has entrypoints with listEntrypoints. For private/local targets, specify a connected repeater via repeaters. |
| getDiscoveryStatus | Get the current status of a discovery run. |
| listDiscoveries | List discovery history for a project. View past discovery runs or monitor ongoing endpoint discovery. |
| uploadApiDefinition | Upload an API definition file (OpenAPI/Swagger) by URL or content. Returns a file ID to reference in discovery runs. |
Entrypoint Management
| Tool | Description |
|---|---|
| listEntrypoints | List discovered API endpoints/URLs for a project. Use this to select entrypoints for scans or evaluate attack surface coverage. Supports filtering by HTTP method, status, and text sea |